diff --git a/local-app/python-tools/idc-membership-check/user_update.sh b/local-app/python-tools/idc-membership-check/user_update.sh
index 62a63be1..4db00b95 100755
--- a/local-app/python-tools/idc-membership-check/user_update.sh
+++ b/local-app/python-tools/idc-membership-check/user_update.sh
@@ -1,8 +1,20 @@
 #!/bin/bash 
 
+cleanup()
+{
+   local rstatus=$?
+   if [[ ! -z $TMPDIR ]] && [[ -e $TMPDIR ]]
+   then
+     rm -rf $TMPDIR
+   fi
+   exit $rstatus
+}
+trap cleanup EXIT
+
 THIS=$(basename $0 .sh)
-VERSION="1.0.7"
+VERSION="1.1.2"
 # set -euo pipefail
+export TMPDIR=$(/bin/mktemp -d /tmp/user_update.XXXXXXXX) || (echo "#* error making TMPDIR" && exit 1)
 
 # variables passed by caller
 #  SUMMARY_CSV=/path/to/idc_reconcile.summary.csv
@@ -52,51 +64,73 @@ u_pending_add=$(awk -F, 'NR>1 { if ($1=="USER" && $6==1) { print $2 }}' $SUMMARY
 c_pending_add=$(awk -F, 'NR>1 { if ($1=="USER" && $6==1) { c+=1 }} END {print c}' $SUMMARY_CSV)
 echo "PROGRESS:$C/$TASKS" > "$STATUS_PIPE"
 
+set -euo pipefail
 C=$(( C + 1 ))
 text="$C/$TASKS: tf-apply targets (add)"
 echo "## $text"
 echo $text  > "$STATUS_PIPE"
-targets=""
-for u in $u_add 
-do
-  targets+=" -target=data.ldap_object.users[\"$u\"]"
-  targets+=" -target=aws_identitystore_user.users[\"$u\"]"
-done
-tf-apply -auto-approve $targets
-status=$?
+if [ $ADD_COUNT -gt 0 ]
+then
+  targets=""
+  for u in $u_add 
+  do
+    targets+=" -target=data.ldap_object.users[\"$u\"]"
+    targets+=" -target=aws_identitystore_user.users[\"$u\"]"
+  done
+  #tf-apply -auto-approve $targets
+  tf-plan -refresh=false -out=$TMPDIR/user_add.json $targets
+  tf-plan summary
+  tf-apply -refresh=false $TMPDIR/user_add.json
+  status=$?
+fi
+set +euo pipefail
 
 C=$(( C + 1 ))
 text="$C/$TASKS: remove users from .csv"
 echo "## $text"
 echo $text  > "$STATUS_PIPE"
-for u in $u_delete
-do
-  sed -i -e "/^$u\b/d" users.csv
-done
-status=$?
+if [ $DELETE_COUNT -gt 0 ]
+then
+  for u in $u_delete
+  do
+    sed -i -e "/^$u\b/d" users.csv
+  done
+  status=$?
+fi
 
 C=$(( C + 1 ))
 text="$C/$TASKS: remove users from .yml files"
 echo "## $text"
 echo $text  > "$STATUS_PIPE"
-for u in $u_delete
-do
-  sed -i -e "/- $u\b/d" $(rg -g "*.yml" -l -- "- $u")
-done
-status=$?
-
+if [ $DELETE_COUNT -gt 0 ]
+then
+  for u in $u_delete
+  do
+    sed -i -e "/- $u\b/d" $(rg -g "*.yml" -l -- "- $u")
+  done
+  status=$?
+fi
+
+set -euo pipefail
 C=$(( C + 1 ))
 text="$C/$TASKS: tf-apply targets (delete)"
 echo "## $text"
 echo $text  > "$STATUS_PIPE"
-targets=""
-for u in $u_delete
-do
-  targets+=" -target=data.ldap_object.users[\"$u\"]"
-  targets+=" -target=aws_identitystore_user.users[\"$u\"]"
-done
-tf-destroy -auto-approve $targets
-status=$?
+if [ $DELETE_COUNT -gt 0 ]
+then
+  targets=""
+  for u in $u_delete
+  do
+    targets+=" -target=data.ldap_object.users[\"$u\"]"
+    targets+=" -target=aws_identitystore_user.users[\"$u\"]"
+  done
+  #tf-destroy -auto-approve $targets
+  tf-plan -refresh=false -destroy -out=$TMPDIR/user_delete.json $targets
+  tf-plan summary
+  tf-apply -refresh=false -destroy $TMPDIR/user_delete.json
+  status=$?
+fi
+set +euo pipefail
 
 #echo "RESULT:SUCCESS:$c_add:$c_delete:$c_pending_add"   > "$STATUS_PIPE" 
 #echo "RESULT:FAILURE:0:0:0"    > "$STATUS_PIPE"